fix(frontend): thirteen small UI, validation and a11y fixes

[cristim]

Summary

Thirteen small frontend fixes, one commit per issue plus review follow-ups.

Closes #50
Closes #133
Closes #179
Closes #184
Closes #715
Closes #187
Closes #216
Closes #273
Closes #275
Closes #277
Closes #280
Closes #752
Closes #1131

Issue	Fix
#50	Add Purchases refuses a start date before tomorrow (UTC), matching the server rule; the picker min uses the same rule
#133	A stored max amount of 0 is shown instead of blank; save refuses 0, negative or unparsable caps (blank stays "no limit", owner decision 2026-10-16)
#179	Active commitments show the account id once when the name already contains it
#184	Glyph-only planned purchase row actions get aria-labels
#715	The profile entry point is a real button; opening it from the mobile drawer keeps focus in the modal
#187	The sidebar highlights the item for the current URL before user and permission fetches finish
#216	Opening the mobile drawer focuses the first visible nav link
#273	apiRequest returns null only for 204 or an empty body; other 2xx parse failures reject
#275	Bulk user delete uses allSettled, reloads and deselects in every case, and names the users that survived
#277	AWS no longer offers monthly as a payment option
#280	An empty dashboard summary raises a named error instead of a TypeError
#752	The per-service chart tooltip renders for committed services without recommendations
#1131	GCP offers only monthly, matching config.ValidPaymentOptionsByProvider

Jest now runs with TZ=America/New_York through a globalSetup, so a local-date implementation of the UTC start-date rule fails even on a UTC CI runner.

Verification evidence (independent reviews, local build and tests at the head SHA) is posted as PR comments.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 28 billable files and costs up to $7.00.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 48 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 88 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-platform/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: 635d36c0-1abf-45e9-b38c-3d42c1697db3

📥 Commits

Reviewing files that changed from the base of the PR and between d9b2aa7 and c565be0.

📒 Files selected for processing: 28

• frontend/package.json
• frontend/src/__tests__/api.test.ts
• frontend/src/__tests__/app.test.ts
• frontend/src/__tests__/auth.test.ts
• frontend/src/__tests__/dashboard.test.ts
• frontend/src/__tests__/globalSetup.ts
• frontend/src/__tests__/groups.test.ts
• frontend/src/__tests__/html.test.ts
• frontend/src/__tests__/inventory.test.ts
• frontend/src/__tests__/mobile-nav.test.ts
• frontend/src/__tests__/plans-permissions.test.ts
• frontend/src/__tests__/plans-range-validation.test.ts
• frontend/src/__tests__/purchase-compatibility.test.ts
• frontend/src/__tests__/recommendations.test.ts
• frontend/src/__tests__/users.test.ts
• frontend/src/api/client.ts
• frontend/src/app.ts
• frontend/src/auth.ts
• frontend/src/dashboard.ts
• frontend/src/groups/groupModals.ts
• frontend/src/index.html
• frontend/src/inventory.ts
• frontend/src/lib/purchase-compatibility.ts
• frontend/src/navigation.ts
• frontend/src/plans.ts
• frontend/src/recommendations.ts
• frontend/src/styles/layout.css
• frontend/src/users/userActions.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Merge gate at c565be0f2f8f0a135692e282cabb64dc87f7fa68

Independent review 1 (cold brief, non-author): APPROVE c565be0f2f8f0a135692e282cabb64dc87f7fa68 (pass 1 APPROVE at d7a3748e, pass 2 on the delta)

Pass 1 checked the UTC start-date rule against handler_plans.go:575-581 (frontend minimum equals the first server-accepted date, including 23:xx and 00:00:00Z), the jest globalSetup TZ taking effect in workers (probe tests saw America/New_York, offset 300, also with --runInBand), apiRequest callers and the backend buildResponse nil-body {} behaviour (#273), and the payment allow-lists against ValidPaymentOptionsByProvider (#277/#1131). Mutations killed: local-date earliestStartDate, apiRequest catch-to-null, GCP all-upfront allowed, AWS token guard removed.

Pass 2: c565be0f widens isBucketPaymentCompatible (only caller handleBulkPurchaseClick); buckets are keyed by provider|service|term|payment|account, so mixed selections still fan out, and resolvePerRecPaymentSeed seeds only a supported own payment, so the single modal cannot receive an unsupported payment. 9290310c: validity.badInput is the right signal. Mutations killed: own-payment clause removed; badInput check replaced with false. Nit: no test for "own payment unsupported and toolbar unsupported" (a loosened gate survived); correct by reading.

Independent review 2 (cold brief, non-author): APPROVE c565be0f2f8f0a135692e282cabb64dc87f7fa68 (pass 1 REQUEST_CHANGES at d7a3748e)

Pass 1 blocking finding: a type="number" Max Amount input sanitizes unparsable text to "", which read as blank ("no limit"), so a typo silently removed the cap; the tests used type="text" and hid it. Fixed in 9290310c (validity.badInput refused; tests use real number inputs); mutation (badInput check -> false) fails a groups test. Pass 1 nit on the #216 comment fixed in fd4e3555.

Pass 1 also verified #50 against handler_plans.go:575-581, #273 void-DELETE bodies, #275 allSettled/reload/error text, #715/#184 accessible names, and killed mutations on #133 zero, #275 deselect and #273 parse rejection.

Pass 2 attacked c565be0f: mixed selections always produce more than one bucket (key provider|service|term|payment|account); AWS/Azure own-payment arm still calls isPaymentSupported (AWS monthly/upfront and RDS 3-year no-upfront still rejected); null own payment falls back to the toolbar rule as before; every modal seed branch checks isPaymentSupported. Targeted jest (5 suites, 556 tests) passes.

Local verification (macOS, exact head, worktree clean):

• npm ci, npm run build, npm run lint (0 errors) and npx jest (108 suites, 3416 passed, 1 skipped) all pass.
• The implementer reproduced the GCP execute-now Playwright failure and ran tests-e2e/execute-now-warning.spec.ts after the fix: 4/4 pass.

CI: all checks are green at this SHA, including Frontend E2E.

Threads: none open. CodeRabbit is waived as a merge gate.